Switch off one account's own policy

Retires the active policy of an account in the caller's tenant. The account then answers to platform and tenant policy alone — which is where it would be had it never written one, so this can only return an account to access its role and the tenant's policy already allow. The account keeps its version history and can activate a version again; to stop that, change its role or the tenant's policy. An account outside the caller's tenant is not found by construction: the tenant comes from the credential, never the request.